CYNERGI
   
About us; PartnersPortfolio & major clientsFAQ, support & contacts
Portuguęs!Home
Web EngineeringWeb HostingWeb Consulting

TCSEC, ISO 7498-2: Standard-based security


Security is too much of a delicate subject to be approached from a company's subjective opinion of what "security" means.



Secure hosting

Family Hosting 
Reserve a domain name for your family name, create e-mail addresses for your children!

Professional Hosting 
With dual domain name included, pre-installed resources for Web development and professional Webmail with employee monitoring support. Includes one Web site template of your choice, for free.

Commerce Hosting 
With triple domain names and built-in EV certificate, these hosting accounts have everything you need to start a trusted electronic commerce site on the Internet. Includes two Web site templates of your choice, for free.

Server 
Adding full predictability to your hosting: a full dedicated non-virtual non-cloud* server with its own FQDN* and IP address* adds performance predictability to your site and reduces the chances that your sent e-mail messages are flagged as spam by recipients.

ISO 7498-2 services

Authentication
Data access requires the identification of the party performing the access – this is true for private access to our services (such as the backoffice and FTP*).

Access control
Only the authenticated party can access its data – ensured by proper file system* permissions and by proprietary folder allocation (see more to the right).

Data confidentiality
Data is not visible (or at least understood) by third parties while in transit – ensured by the availability of properly configured SSH* and TLS/SSL* (see more to the right).

Data integrity
Data is not modified while in transit – ensured by properly configured SSH and TLS/SSL, built-in Webmail with support for digital signatures, and a proprietary Cynergi script for digitally signing e-mails.

Security in projects

Cynergi projects that had a strong IT security component:

Secure extranet, and intranet in ASP with Oracle back-end 

Secure e-mail management system 

Webmail with digital signature support 

Legal act registration system 


  Order 

Access
control


A Web server is secure when it's switched off and locked away in a vault. Unfortunately that server is also useless for hosting.

Server security is always a compromise between "closed doors" and function. At Cynergi we believe to have achieved an excellent balance between these requirements.

When you log into a hosting account with private FTP* you will find the following folders (some names have been changed for security reasons):

conf
home
logs
mail
priv
www

The "logs" folder has your Web site access logs ready for download. You cannot create new files here, nor make any changes to the existing ones – they will be deleted automatically.

"mail" holds messages and configuration of every e-mail mail box. You can only access this folder by reading e-mail (i.e., by POP*/IMAP*, and never by FTP, PHP* or CGI*).

"www" and "conf" are both accessible to FTP, PHP and CGI, but the Web server only has permissions to use "www" for Web site files. "conf" can then only be used indirectly by the Web site to store configuration files (PHP, XML or another format) used by PHP and CGI, but which shouldn't be directly read by a browser*.

"priv" can only be accessed by the main private FTP. It can be used to exchange files between company's employees, ensuring privacy.

Finally, "home" is the folder where "secondary" private FTP user accounts are created. It can be accessed by FTP, PHP and CGI which allows you to have internal and external collaborators managing different parts of the Web site without accessing other parts.

Each "secondary" FTP user will have its own operating system user. This provides more insight during a forensic Web site analysis should its security become compromised.

ISO/IEC 15408
and updates


Our Web hosting services use operating systems that have achieved the C2 security level of the TCSEC standard* and the EAL 4+ level of the ISO/IEC 15408 standard*, which means they are "methodically designed, tested and reviewed" to be safe. Levels EAL 5 and above typically involve security demands at the government level.

Servers with both Unix and Windows operating systems are configured to update themselves daily, ensuring that the security levels are kept.

Confidentiality
and data integrity


Our Web hosting allows the establishment of SSH* tunnels (a type of VPN* between your computer and the server) to access each service privately.

[Private SSH/SSL communication diagram]

This technology doesn't prevent third parties from seeing the communication between your computer and the server, but it prevents it from being understood.

The Web (HTTP*), FTP* and e-mail (SMTP*, POP* and IMAP*) services are also available via TLS/SSL* which offer the same kind of privacy but are easier to use.

Specialized
configuration


Security isn't limited to specific file and folder permissions, but also to the secure configuration of services and functions.

Each server has all services disabled, except those it is offering its clients. There's a firewall that detects unacceptable behavior (port scans, etc.), blocking all such access and there are daily server log reports sent to Cynergi server administrators for auditing and discovery of situations that deserve greater scrutiny.

Our server network follows a peer-to-peer* model where each server operates almost completely independently. This includes server-to-server authentication, i.e. each server doesn't implicitly trust our other servers and makes them supply proper credentials for every operation requested. This means that if a client is compromised by a hacker, only that client's services (on any server) can be manipulated by the hacker. Similarly, if an entire server is compromised by a hacker, he will not have automatic access to the remaining servers.

PHP*, Perl*, MySQL* and other development resources offered in our Web hosting are configured for security. This means delimiting the areas of the system where each client can work, limiting the computer resources (processing time, memory, disk space, etc.) they can use or disabling old functions that are known to cause security problems.

PHP for instance is configured not to automatically define global variables when receiving external data and MySQL is configured to force the use of strong passwords, thereby eliminating some known security problems with this engine. The interaction between these two can be made without using passwords (only "mysql_connect()") since MySQL credentials are pre-configured for each account in private files not accessible to clients. This limits the damage done by a site compromise.

Group Corebase